Hacker News Reader

Comment by daenz | Hacker News Reader

>All in-game shutters like the one from when you kill a zombie are fixed because Capcom DRM’s entry points are patched out so most of their functions are never executed anymore.

Can someone knowledgeable explain why DRM functions would be called on every zombie kill? I guess I don't have a good understanding on how these DRM checks are implemented in games in general.

View on HN

DRM calls are sprinkled everywhere inside the code, usually statically linked or even inlined. This is to make it harder for crackers to identify them.

Here they put some in the zombie kill routine, but I don't think there is anything special about zombie kills. It could have been anything: picked up ammo, loading a map, pass a certain event, on a timer, during a save, all of the above, etc...

I don't have a deep knowledge about the technology involved but from what I've seen modern DRM like Denuvo are based on virtual machines and are very flexible, allowing all sorts of checks at many points. Done well, there is little overhead, but some overzealous publishers do frequent lengthy checks, killing performance.

If there is little overhead, then the game is cracked easily as the checks are rare and easily found.

For the DRM to hold up the checks need to be frequent, hard to pin down and in practice that means in performance critical, complex code that can behave in unexpected ways.

Quote:"...but some overzealous publishers do frequent lengthy checks..."

Since when do publishers have access to source code to do those checks themselves? Developers do that. And yes, I am aware that in this particular case, for RE:Village, the developer and publisher are the same.

I would think it very odd if publishers were not given the source code. If you were a publisher, would you want some small shop to be able to disappear off the face of the Earth, preventing you from ever doing even simple ports and patches?

That actually happens a lot. Mass Effect Legendary Edition is missing a DLC because the source code was lost. Many of Square Enix's hit games like the PS1 Final Fantasy games and the PS2 Kingdom Hearts have lost the original source code and the modern ports are either based on PC ports or are rebuilt from the shipped assets.

Also I have a very strong impression Legend of Mana for PC is... emulated.

It has the same slowndowns it used to have on PSX, but somehow, worse, the game runs quite poorly during combat, stuttering when there is any new sprite on the screen.

I think they lost the source code, and made an emulator just f or this game, to allow them to shove the new "remastered" assets in (the remastered assets are just AI-processed backgrounds... quite poorly sometimes even, for example in one screen something that is clearly some grass near a fountain on PS1 became a green smudge on PC).

Neither of those examples have anything to do with if a publisher was given access to the source. Those seem to be more about those games being developed in a time when source control and backups were handled more loosely within the industry as a whole.

And that does not only apply to games, certain parts of MS office do not have source available anymore so MS has done binary patches to fix bugs, pixar almost lost part of a movie but an employee happened to have a offsite copy at their home.

EA released a remastered C&C some time ago. One of the developers involved in that described the problems they had with the video quality, the originals where lost, the best they could do was extract videos from the PlayStation port and try different AI up scaling algorithms. The result isn't pretty.

The best they could do is recreate and rerender the videos, but that's probably too costly for EA's typical remaster project.

A lot of the videos in C&C were live action

Which would almost certainly have required different actors, given the 25 years since the original release, and I imagine that would have cause a huge uproar in addition to being fairly expensive.

That was probably well out of scope of what they originally planned for as C&C had quite a lot of pre and post mission videos.

Out of scope, sure, but I agree that that option prevents "extract old video from the production version and try to upscale it automatically" from qualifying as "the best they could do".

"Best they could do" on the budget from EA.

Sure, that's fair.

Depending on the contract, publishers might have the ability to get a copy of the source code, but they certainly are not going to be monkeying around with it.

Doing a full build from scratch of a game is a complicated thing. The build systems at a game studios are quite extensive.

Even if you were given access to the version control repositories for a game I think it would probably take you quite a long time to be able to successfully export and build everything from scratch.

I imagine the DRM is contracted out to a company which the publisher uses for more of their games. The DRM guy or gal comes in a couple days around the end of development, imports some libraries, and sprinkles some function calls here and there. There either isn't the knowledge/time/co-operation to optimize it, or the actual devs are told to stay well away from the DRM stuff to avoid messing something up and causing piracy false positives.

Not that I'm in the know, but it seems likely that publishers can get code into the binary one way or the other.

The DRM in this case, Denuvo, is a framework. One that is very finicky to work with and it has a gazzilion of different API's which are variants of same basic thing, but when compiled it goes into different code machine. Also, strictly speaking, is not the programmers that embed Denuvo in the game, is the level designers. They are the one who select where in the game the checks are made.

And crackers, until they don't get to that point in game, they have no idea that what's ahead is legit game code or just another Denuvo trap to trigger something (game crash, patch previous cracked portion of game, corrupt saves, etc etc - the possibilities to fuck with the cracker are limited only by imagination). That's why cracking takes time when it comes to Denuvo, because is a tedious step-by-step dissembling boring job.

> Done well, there is little overhead, but some overzealous publishers do frequent lengthy checks, killing performance.

I can imagine disaster if someone inlines the wrong function here. Definitely something that shouldn’t make it out the door, but amazing the difference 6 letters could make.

Why can inlining functions cause disasters? Just instruction cache misses, or other things as well?

My guess is they want intermittent checks, but don't trust the system clock to advance, but a zombie kill is evidence that time has advanced for the player. Seems like it shouldn't block the main game thread and there should be a longer time to live for that check, and maybe those are the bugs.

Do some cracks rely on preventing the system clock from advancing?

Generally in a software system you can't count on a time source to move forward, to move in consistent intervals, or to move at all. In a system that is designed to be resistant to attack, it actually makes a lot of sense to instead rely on a desirable event critical to progression. Especially one that occurs relatively infrequently and is likely associated with a lot of other complex calculations.

I think this is pretty smart.

I think I understand the theory. If I was a cracker though, I would think that patching out the system clock calls (in order to prevent DRM checks) would have a lot of game-breaking unintended side-effects (animations, other time-based mechanics, etc). And if that was the case, it would be a perfect place to trigger the DRM calls, since a cracker couldn't patch the system time calls without breaking the game.

tehbeard (another comment in this thread) makes a point that maybe not attaching the DRM calls to the clock makes it easier to hide them, since a cracker would probably be looking for a time-based trigger.

A game’s animation and other in-game timing functions are very unlikely to be based on wall-time, instead typically relying on monotonic counters that are higher resolution, less overhead, and not potentially adjusted backwards or forwards while the game is running. Thus, disabling wall-time accesses for a crack should have little influence on game timing and animations.

That makes sense to use monotonic counters for game mechanics. I think the point still stands in that case though: if the DRM calls were tied to the same time source as the animation system, you couldn't patch one without breaking the other.

That's assuming you couldn't selectively patch the calls, but yes, sounds as though it would be harder.

> Generally in a software system you can't count on a time source to move forward, to move in consistent intervals, or to move at all.

By way of illustrating this point: C++ has std::chrono::system_clock, std::chrono::steady_clock, and std::clock, all of which give different guarantees on how the clock behaves.

More that the function calls for the system clock are fairly easy to trace back to find these DRM hooks.

I’m not a cracker but messing with the system clock is a classic exploit for all kinds of things.

In the late 90s early 2000s for some stuff you didn't need cracks, you could often literally just set the system clock back to 1990.

If there was a free trial, yes.

If the DRM code was cleanly separated from the normal flow of the game code, it would be trivial for crackers to patch it out.

Evidently it's still trivial for crackers to patch it out

I wouldn't say it's trivial. EMPRESS is one of the most talented crackers on the scene at the moment and it took ~2 months for this release.

Arguably, without EMPRESS, the crack would have taken a lot longer.

I think publishers should be happy with that. Every day a crack doesn’t come out is one more teenager who is hyped about latest game who will buy it.

Yeah, a lot of publishers voluntarily remove DRM from their games after a few months because most of the profit is made right at launch. Once the first round of discounts start to hit DRM serves no purpose anymore.

It's even better! You sign a contract with denuvo for how many days protection. The less days the less you pay. When the contract is up they remove it

I have never heard of this. Do you have any examples?

Search for "Denuvo removed" on Google. Lots of recent examples.

Doom Eternal & Metro Exodus – https://www.gamesindustry.biz/articles/2020-05-29-denuvo-sec...

Monster Hunter World – https://www.vg247.com/2021/06/03/monster-hunter-world-denuvo...

Mass Effect Legendary Edition – https://www.nme.com/news/gaming-news/mass-effect-legendary-e...

Nier Automata – https://www.nme.com/news/gaming-news/nier-automata-update-re...

Capcom themselves did it with the rerelease of RE2 and RE3

Steam wish list. Pick it up for $15 and get a better experience with the DRM removed. Thanks Capcom!

> Every day a crack doesn’t come out is one more teenager who is hyped about latest game who will buy it.

Taken literally, that's all of ~60 additional copies sold!

Publishers put this DRM in place only as a short-term measure, removing it within a year in almost all cases after the majority of their sales are well gone. They do this in the hope to convincing people who might pirate the game to ultimately purchase it, which I'm assuming must work to some extent or they wouldn't pay the rather high costs of Denuvo, etc. (and I'm willing to bet their sales data probably supported this theory).

1. People who want to play the game online or are hyped and preorder it

2. People who want to play the game immediately and can’t wait, but will download it for free if they can

3. People who want to play it but are happy to wait for a sale

4. People who will never buy the game, but will play a cracked version

Group 2 is pretty huge, and includes age groups who care a lot about cosmetic items online (teenagers-20s)

I'm under the impression that the group of people who if they can pirate something, will do so and never buy it, but if they can't, will just buy it, is quite small indeed.

Every time it comes out that a pirate version fixes things broken in the mainline version, esp if drm is what broke it, I slide more firmly into always pirate category.

meaningful online service is the only thing that drives me to buy AAA games now and days, and most don't even have that.

Do people in the "always pirate category" buy games that they can't pirate, though? Or do they just skip those games and play different ones instead?

That describes me. I pirated lots of games when I was still into gaming. I bought Tribes 2, for example, because of course you can't pirate it if you want to play online (and it's a multiplayer-only shooter). Same for e.g. PUBG and one or two others.

Steam is a great thing for anti-piracy; 99% of the time it works without any friction and is faster/safer than piracy.

On the other hand I've only played the original Call of Duty and BF1942, and have neither paid for nor pirated any of the sequels of either. Frankly most AAA games actually really suck.

I generally won't buy single player games I can't pirate. The reason for this is they either have some online only bullshit, which is unacceptable in a single player game, or some DRM performance degrading virus.

The only game I pirated in the last 10 or so years was Metro Exodus because it was removed from the Steam store just before launch.

> The only game I pirated in the last 10 or so years was Metro Exodus because it was removed from the Steam store just before launch.

I waited until I could buy it for ridiculously dirt cheap on sale (literally a tiny fraction of full asking price) because their actions at launch destroyed my willingness to pay full price. Had they done things differently, they easily could have had me as a happy full price purchaser.

Interesting, does this mean DRM functions are forced inline when compiled?

Not just that. I'm not an expert, but from what I read, some DRMs will encrypt assets and critical game logic and let them be decrypted in real time on a virtual machine so that they aren't directly extractable from memory.

Once is in memory, encrypted or not, it can be extracted, inspected and replaced (which is what a launcher crack style does).

Yes, but figuring this out can still take a long time. Splinter Cell: Chaos Theory survived for over 400 days before being cracked.

It can be useful to break the game in subtle ways so that the crackers have a harder time knowing when the crack is fully done. https://www.nag.co.za/2013/10/23/the-5-biggest-and-most-awes...

Probably a possible “checkpoint” from Denuvo or similar DRM manufacturers. One would define an “event” for the DRM to trigger. Sometimes it’s starting the game, starting a New Game, loading game/saving game, and so on. Perhaps Capcom thought to (perhaps aptly?) make the check that if you kill a zombie in the zombie game, it checks if you bought the rights to do so.

Reply on news.ycombinator.com